https://nalar.dev/tags/csrf/ Recent content in CSRF on Nalar Hugo en-us Wed, 02 Sep 2026 00:00:00 +0700 https://nalar.dev/practical-csrf-defense-with-samesite-cookies-and-tokens/ Wed, 02 Sep 2026 00:00:00 +0700 https://nalar.dev/practical-csrf-defense-with-samesite-cookies-and-tokens/ <p>Cross-site request forgery (CSRF) abuses the fact that browsers can automatically attach a user&rsquo;s cookies to requests. If a state-changing endpoint trusts only the presence of an authenticated cookie, another site may be able to trigger that endpoint from the user&rsquo;s browser.</p> <p>Modern cookie controls reduce the attack surface, but robust applications still need to reason about request semantics and trust boundaries.</p> <h2 id="understand-the-condition-that-makes-csrf-possible">Understand the condition that makes CSRF possible</h2> <p>A typical CSRF attack needs three ingredients:</p>